EUVD-2026-54423
GHSA-63m9-m4r7-4qjg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-delivered crafted payload requires no authentication or interaction; impact is strictly availability via process crash, with no confidentiality or integrity effect.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
5DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic.
This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users of other language implementations are not affected.
Users are recommended to upgrade to version 1.5.0, which fixes the issue.
AnalysisAI
Denial of service in the Go implementation of Apache Fory allows unauthenticated remote attackers to crash affected services by sending crafted serialized data containing malformed type metadata, triggering an uncaught Go runtime panic. Affected versions span 0.16.0 through 1.5.0 (exclusive), while all non-Go language implementations remain unaffected. No public exploit code or active exploitation (CISA KEV) has been identified; the EPSS score of 0.18% (8th percentile) corroborates low current exploitation activity despite the high CVSS base score.
Technical ContextAI
Apache Fory is a high-performance cross-language serialization framework; CVE-2026-71559 is isolated to its Go implementation. The root cause is CWE-502 (Deserialization of Untrusted Data): when the Go deserializer processes incoming byte streams, it parses embedded type metadata to reconstruct objects. A specially crafted payload can supply structurally malformed type metadata that the parser does not defensively validate, causing an uncaught panic - the Go runtime's unrecovered exception mechanism - which terminates the process. The CPE cpe:2.3:a:apache_software_foundation:apache_fory:*:*:*:*:*:*:*:* covers all platform/edition variants, but the description explicitly limits impact to the Go implementation. This class of flaw is common in serialization libraries that trust type hints embedded in the serialized stream.
RemediationAI
The primary fix is to upgrade to Apache Fory 1.5.0, which resolves the uncaught panic by adding defensive validation of type metadata during deserialization. The patch is confirmed available per the Apache project advisory at https://lists.apache.org/thread/f28bw002p32yt723rvv3dcwdkljys8r3. If immediate upgrade is not possible, the most effective compensating control is to restrict what data sources the Go Fory deserializer processes: enforce that only internally generated or cryptographically authenticated serialized payloads are accepted, rejecting any externally supplied input before it reaches the deserialization layer. Placing an API gateway or input validation proxy in front of endpoints that invoke Go Fory deserialization can enforce this boundary with minimal application changes, though it adds operational complexity. There is no indication of a configuration flag to disable the vulnerable type-metadata parsing path within the library itself.
More in Apache Fory
View allRemote code execution risk in Apache Fory (the Java serialization framework formerly known as Fury) before 1.4.0 arises
Heap type confusion in the Apache Fory C++ deserialization engine (versions 0.14.0 up to but not including 1.5.0) lets a
Insecure deserialization in Apache Fory's PyFory (Python) library allows remote attackers to bypass DeserializationPolic
Memory disclosure and denial-of-service in Apache Fory's Rust deserialization path (versions 0.13.0 through 1.3.0) let r
Out-of-bounds heap read in Apache Fory C++ versions 0.14.0 through 1.4.x allows attackers supplying crafted deserializat
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today